Certified SOC Analyst (312-39) (312-39) — Questions 76–150

A SOC analyst is using GCP and sees an alert regarding 'exfiltration of data' from a Cloud Storage bucket. Which tool should be analyzed to identify the specific file names accessed during the event?

Which THREE items should be included in a standard incident containment report?

Which THREE of the following are essential for effective incident response within a SIEM?

Which of the following is considered a 'Network-based' IoC?

Which THREE factors should be considered when determining the severity level of an incident?

During a phishing investigation, you receive a suspicious link. Which safety measure should you use to analyze the link?

You are managing log rotation on a Linux-based log aggregator. Which configuration file is used by the logrotate utility to define the retention and compression settings for log files?

Your organization is evaluating its SOC maturity using the CMMI-based model. If the SOC has documented standard processes but lacks consistent automation, which maturity level has been achieved?

An analyst is tasked with monitoring for 'Living off the Land' (LotL) attacks. Which of the following built-in Windows utilities, if used by a non-administrative user, warrants immediate investigation?

Which of the following is an example of an 'Indicator of Compromise' (IoC)?

You are configuring AWS GuardDuty to improve threat detection. You need to ensure it monitors for unusual S3 bucket access. Which data source must be enabled for this?

What is the purpose of a 'Lookback Window' in a SIEM correlation rule?

You are designing a rule in a SIEM to detect brute force attacks. What is the most important factor when choosing the time window for the rule?

You are auditing your SOC workflow and find that incident escalations are delayed. Which metric should you analyze to identify the bottleneck between alert detection and analyst assignment?

Which TWO types of evidence are classified as 'volatile' and should be captured first during a forensic investigation?

Which TWO of the following are primary goals of the 'Command and Control' (C2) phase?

Which TWO types of logs are most useful for detecting lateral movement?

You are investigating an unauthorized login to an AWS IAM role. You need to determine the specific API call that was made and the source IP address. Which AWS service should you query?

In the context of proactive detection, which TWO of the following are effective methods for identifying 'Low and Slow' exfiltration attempts?

Which THREE items are essential components of a robust log management policy?

Which TWO of the following are valid reasons for an analyst to escalate a SIEM incident?

You are auditing user access logs for a potential privilege escalation. What indicates that a user has successfully used 'runas' to switch context?

In a Windows environment, which artifact would provide the best evidence of 'Lateral Movement' using Pass-the-Hash?

When conducting a forensic investigation, you need to ensure the integrity of the collected digital evidence. What is the most critical step to perform immediately after copying the original media to a forensic workstation?

Which THREE of the following are common steps during the 'Alert Triage' process?

Which THREE factors should be considered when determining the log retention period in a SOC environment?

Which of these is a common SIEM data ingestion protocol?

Which TWO of the following are valid examples of 'Host-based' Indicators of Compromise?

A SOC is implementing a 'Follow-the-Sun' model. What is the most critical requirement for this transition to be successful?

Which THREE of the following are commonly monitored artifacts for detecting 'Persistence' mechanisms?

When implementing a centralized logging architecture, which protocol is preferred for log transmission to ensure delivery confirmation between the collector and the aggregator?

While hunting for persistence mechanisms, you observe a suspicious scheduled task. Which detail in the task definition is the most critical indicator of a malicious actor rather than a legitimate software update?

You are performing a cloud-native incident response in AWS. You need to isolate a compromised EC2 instance without deleting the volume. What is the standard process?

A SOC analyst is integrating a new STIX/TAXII feed into a SIEM. Which configuration setting is mandatory to ensure the automated ingestion of threat indicators correctly maps to the internal incident response workflow?

In the context of the MITRE ATT&CK framework, what is the primary goal of the 'Command and Control' tactic?

Which SOC service model involves an organization outsourcing its security monitoring to a third-party provider while retaining internal control?

When dealing with a ransomware incident, why should you prioritize disconnecting the host from the network over immediate rebooting?

A SOC manager is defining the tiered structure of the SOC. Which tier is primarily responsible for initial triage and basic incident filtering?

You are tasked with tuning a SIEM rule that is triggering on legitimate internal vulnerability scanners. What is the best course of action?

Which THREE actions should be taken after an indicator of compromise (IOC) is identified to ensure it is effectively used in a proactive detection program?

Which THREE factors contribute to 'dwell time' in a security incident?

During a threat hunting exercise, an analyst discovers a suspicious PowerShell execution pattern using encoded commands. Which technique should the analyst employ next to determine if the activity is malicious or legitimate system administration?

Which TWO of the following are standard log types ingested into a SIEM?

When building a new SIEM use case, what is the first phase of the development lifecycle?

During alert triage, why is it important to check the 'source' of an alert?

A SOC analyst is preparing to collect digital evidence from a compromised server. Which TWO actions must be documented to maintain a proper Chain of Custody?

When analyzing network traffic associated with a malware C2 channel, you observe encrypted traffic. Which approach allows you to inspect the content of this traffic without the malware's private key?

You are defining log retention policies. According to general compliance standards like PCI-DSS, what is the primary requirement for log retention?

You need to export a PCAP for a suspicious network flow. Using Wireshark, which filter would you use to isolate traffic from a specific suspicious source IP 192.168.1.50?

Which TWO of the following are key components of a successful SIEM use case development process?

Which TWO actions should an analyst take when reviewing an alert that has been flagged as a 'False Positive' in the SIEM?

You receive an alert for 'Account Lockout'. You check the logs and see 10 failures in 1 second. What does this suggest?

Which TWO of the following are primary components of a SIEM architecture?

You are reviewing a SIEM alert and see a 'Successful login' from an unusual location. What is the next logical action?

What is the primary function of an IOC (Indicator of Compromise) in an incident?

A SOC analyst is tasked with reducing 'alert fatigue' by categorizing alerts based on their MITRE ATT&CK technique mapping. Which phase of the incident response lifecycle is the analyst performing?

You suspect an attacker is using a specific user account to log in from multiple geographic locations simultaneously. Which SIEM capability allows you to detect this?

An analyst notices a spike in outbound traffic to a known sinkhole IP address. What does this indicate?

You are configuring an EDR tool to detect potential credential dumping. Which specific behavioral indicator is most effective at identifying an attacker attempting to access the LSASS process memory?

What is the primary goal of the 'Eradication' phase in the Incident Response lifecycle?

In IBM QRadar, you notice that a specific log source is not contributing to offense creation. Upon checking the 'Log Activity' tab, you see events are being parsed but are not mapped to any QID. What is the next logical step?

An organization has a SIEM and is struggling with 'alert fatigue.' What proactive measure should the SOC manager implement to improve the Signal-to-Noise ratio?

You are designing a correlation rule in an ArcSight ESM environment. You need to aggregate events based on a 'SessionID' field, but the 'SessionID' is not explicitly parsed in the incoming CEF logs. What must you do first?

You are configuring a SIEM alert threshold to reduce noise. Which metric should you adjust to ensure that only events occurring 5 times within a 60-second window trigger a high-severity alert?

Which TWO settings should you prioritize when configuring AWS CloudTrail for a robust security audit trail?

What is the purpose of normalizing logs in a SIEM?

Which TWO actions should be taken immediately upon identifying an active malware infection on a workstation?

You are performing static analysis on an suspicious executable. You want to view the imported functions, strings, and headers without executing the code. Which tool is most appropriate for this task?

During a forensic analysis, you find a 'shimcache' entry indicating an executable ran from a volume that no longer exists. What does this suggest?

Which THREE of the following are common indicators of a cloud account compromise that should be monitored in your SOC?

In ArcSight, a correlation rule is failing to trigger despite matching event patterns. You verify the filter logic is correct. What is the most likely cause?

Which TWO pieces of information are critical to include in an initial incident ticket?

Which TWO of the following are effective methods for reducing alert volume in a SIEM?

You have captured a malicious binary and are performing dynamic analysis. You observe the malware attempting to resolve a domain that you want to intercept. Which tool allows you to simulate a DNS server response to redirect the malware traffic to a local analysis machine?

A SOC analyst is reviewing logs in a SIEM and notices multiple failed login attempts followed by a successful one from an unknown IP. Which specific IoC category does this activity represent?